CVE-2023-27163 — Request-Baskets SSRF Lab

Project: Vulnerability Research & Reproduction Lab — CVE-2023-27163
Author: Amulya Kaushik
Role: Cybersecurity R&D & Lab Content Development Intern Candidate

Server-Side Request Forgery in Request-Baskets ≤ 1.2.1
A self-contained local research lab for reproducing, detecting, and remediating CVE-2023-27163 with defense-in-depth architecture.

CVE Profile

Upstream Limitations & Remediation Strategy

Note on Upstream Limitations & Remediation:
While CVE-2023-27163 tracks arbitrary forward URL validation, public container builds of darklynx/request-baskets do not enforce loopback or private subnet filtering out of the box. Following real-world DevSecOps best practices, our lab demonstrates remediation through Defense-in-Depth Container Network Isolation. By isolating sensitive internal backends onto an internal-only Docker network (secure-internal-net with internal: true), the relay path is severed, mitigating the exploitability of the SSRF vulnerability even when running untrusted webhook forwarders.

Lab Architecture Overview

This lab provides two discrete Docker Compose topologies:

1. Vulnerable Setup (docker-compose.yml): Request-Baskets and an internal secret echo service share the bridge network lab-net. Request-Baskets is mapped to host port 55556 (mapped from container port 55555).
2. Remediated Setup (docker-compose.patched.yml): Request-Baskets is attached exclusively to public-net, while the internal echo service is attached to secure-internal-net (internal: true).

Vulnerable Architecture (docker-compose.yml)

┌─────────────────────────────────────────────────────────┐
│                    Docker: lab-net                       │
│                                                         │
│  ┌─────────────────────┐    ┌────────────────────────┐  │
│  │  request-baskets     │───▶│  internal-service      │  │
│  │  (v1.2.1)           │    │  (http-echo:5678)      │  │
│  │  Port 55556 ◀──HOST │    │  NOT exposed to host   │  │
│  └─────────────────────┘    └────────────────────────┘  │
└─────────────────────────────────────────────────────────┘
         ▲
         │  HTTP (port 55556)
         │
    ┌────┴─────┐
    │ Attacker │
    └──────────┘

Remediated Architecture (docker-compose.patched.yml)

┌─────────────────────────┐        ┌─────────────────────────┐
│       public-net        │        │   secure-internal-net   │
│                         │        │     (internal: true)    │
│  ┌───────────────────┐  │        │  ┌───────────────────┐  │
│  │  request-baskets   │  │   ✕    │  │ internal-service  │  │
│  │  Port 55556◀─HOST │  │ ──/──▶ │  │ (http-echo:5678) │  │
│  └───────────────────┘  │        │  └───────────────────┘  │
└─────────────────────────┘        └─────────────────────────┘

Prerequisites

Setup Python virtual environment and dependencies:

python3 -m venv .venv
source .venv/bin/activate
pip install requests fpdf2

Step-by-Step Instructions

1. Launch the Vulnerable Lab Environment

Start the vulnerable environment (Request-Baskets v1.2.1 accessible at http://localhost:55556):

docker compose up -d

Verify that both containers are running:

docker compose ps

Expected output:

NAME                         IMAGE                             COMMAND                  SERVICE            STATUS   PORTS
isolated-internal-service    hashicorp/http-echo:latest        "/http-echo -text=CO…"   internal-service   Up       5678/tcp
vulnerable-request-baskets   darklynx/request-baskets:v1.2.1   "/bin/sh -c /bin/ent…"   request-baskets    Up       0.0.0.0:55556->55555/tcp

Confirm that the internal service is not directly reachable from the host:

curl http://localhost:5678 2>&1 || echo "Connection refused — internal service isolated as expected"

2. Execute Vulnerability Reproduction (Data Exfiltration)

Execute the automated SSRF verification script:

python3 scripts/verify_vulnerability.py

What happens:

1. The tool calls /api/baskets/ssrf-verification-basket setting forward_url: "http://internal-service:5678" and proxy_response: true.
2. It sends an HTTP GET to the basket URL.
3. It captures the relayed payload CONFIDENTIAL_DATA{INTERNAL_SSRF_DEMONSTRATION_SUCCESS} and outputs RESULT: VULNERABLE.
4. It deletes the test basket.

3. Execute Defensive Detection Tool

Run the non-destructive audit probe:

python3 scripts/detect.py

What happens:

1. Phase 1: Matches Request-Baskets web signatures.
2. Phase 2: Probes whether loopback forwarding (http://127.0.0.1:80) is accepted.
3. Phase 3: Reports AUDIT RESULT: VULNERABLE upon acceptance (HTTP 201) and cleans up the probe basket.

4. Switch to Remediated Lab & Verify Defense

Switch to the segmented remediated topology:

docker compose down
docker compose -f docker-compose.patched.yml up -d
python3 scripts/verify_vulnerability.py

Expected output:

==============================================================
[✓] REMEDIATION VERIFIED: TARGET SECURED
    The Request-Baskets instance failed to reach the internal
    isolated service (HTTP 502 / Host Unreachable).
    Network segmentation successfully prevented SSRF data exfiltration.
==============================================================

Tear down the environment when finished:

docker compose -f docker-compose.patched.yml down

Evidence & Verification (Deliverable 3)

The complete visual evidence portfolio for Deliverable 3 is maintained in the evidence/ directory:

Detailed walkthroughs, commands, and console transcripts for each screenshot are documented in evidence/README.md.

Interactive Capture Runner

To capture all terminal screenshots sequentially without manual setup hassles, run:

./scripts/capture_evidence_flow.sh

Compiling the Technical Blog PDF

Compile the academic technical report into PDF:

python3 docs/generate_blog_pdf.py

Output generated: docs/CVE-2023-27163-Technical-Blog.pdf

Project Structure

cve-2023-27163-lab/
├── .gitignore                      # Git artifact exclusions (.venv, cache, OS files)
├── docker-compose.yml              # Vulnerable environment (shared lab-net, port 55556)
├── docker-compose.patched.yml      # Remediated environment (disjoint network isolation)
├── README.md                       # Complete documentation, attribution & guide
├── scripts/
│   ├── capture_evidence_flow.sh    # Interactive runner for capturing screenshots
│   ├── verify_vulnerability.py     # SSRF exploitation & remediation verification CLI
│   └── detect.py                   # Defensive audit and detection tool
├── evidence/
│   └── README.md                   # Formal screenshot evidence walkthrough
└── docs/
    ├── technical_blog.md           # Academic technical write-up (800–1,200 words)
    ├── generate_blog_pdf.py        # Markdown → PDF converter
    └── CVE-2023-27163-Technical-Blog.pdf # Compiled academic report PDF

References & Credits

This research and lab development builds upon open security standards, vendor advisories, and vulnerability databases:

1. NIST National Vulnerability Database (NVD):
   CVE-2023-27163 Detail — CVSS v3.1 Base Score 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
2. MITRE Common Weakness Enumeration (CWE):
   CWE-918: Server-Side Request Forgery (SSRF).
3. Upstream Project Repository & Source:
   darklynx/request-baskets (GitHub) — Request Baskets web service.
4. OWASP Foundation:
   Server-Side Request Forgery Prevention Cheat Sheet.

Disclaimer

This lab is intended for educational and authorized security research purposes only. Do not use these tools against systems you do not own or have explicit permission to test.